Kerberos Plug-in for WebLogic Server Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current implementations of WebLogic Server (WLS) do not support Kerberos authentication, leaving a gap in providing security between clients and web services, making applications vulnerable to unauthorized access and data breaches.
Innovation Solution
A Kerberos plug-in component is integrated into the BEA WLS application server, utilizing Java generic security service-application programming interface (GSS-API), BEA WLS security APIs, and Java 2 Enterprise Edition (J2EE) to enable Kerberos authentication for web services, allowing clients to authenticate using Kerberos security tokens and service tickets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Kerberos authentication is not integrated into WLS, then the server maintains simplicity and ease of operation, but security between clients and web services is compromised
Solution Approach 1:
The patent introduces a Kerberos authentication module as an intermediary component that bridges the client and WLS server. This module handles Kerberos ticket verification and authentication, allowing the server to support Kerberos security without requiring core WLS architecture changes. The intermediary handles the complexity of Kerberos protocol implementation while presenting a simplified interface to the existing server framework.
Solution Approach 2:
The authentication functionality is segmented into a separate Kerberos authentication module that can be independently integrated into WLS. This modular approach allows the security enhancement to be added as a distinct component rather than requiring complete system redesign, thereby improving security while minimizing the increase in overall system complexity.
2Reliability
If traditional authentication methods are used without Kerberos, then the system is easier to implement, but applications become vulnerable to unauthorized access and data breaches
Solution Approach 1:
The Kerberos authentication module is designed to work with existing WLS authentication mechanisms, providing multi-functional security support. The module can handle both traditional authentication methods and Kerberos authentication, allowing the system to maintain ease of implementation for existing applications while adding enhanced security capabilities for applications that require Kerberos support.
3Reliability
If Kerberos authentication is integrated into WLS, then strong authentication and data integrity are provided, but the device complexity increases
Solution Approach 1:
The Kerberos authentication module serves as an intermediary that handles the complex cryptographic operations and ticket verification processes. By isolating these complex functions in a dedicated module, the main WLS server architecture remains relatively simple while still benefiting from Kerberos-provided data integrity and authentication services.
Solution Approach 2:
The Kerberos authentication module is designed to be self-contained, handling its own cryptographic operations, ticket verification, and security management independently. This self-service capability reduces the burden on the main WLS system and minimizes the integration complexity, as the module manages its own internal complexity without requiring extensive coordination with other server components.
Data Source
AI summary
Exemplary embodiments relate to methods, systems, and computer program products for providing authentication in a computer environment. The method includes receiving a request for a web service from a client. The request is received at a J2EE based application server hosting one or more applications. The request includes a Kerberos security token and a Kerberos service ticket. Each application has its own Kerberos identity. It is verified that the client has access to the web service using the Kerberos security token and Kerberos service ticket as input to the verifying. The client is provided a connection to the web service if the verifying results in a determination that the client has access to the web service.